This invention relates generally to restoring a computer to a previous state and, more specifically, to restoring a computer to a previous working state by undoing the changes to the computer that occurred since the time of that previous working state.
The components of a modem computer, such as operating systems, hardware, and applications, interact with each other in complicated and sometimes unfortunate ways. For example, one component may optimize its own performance by changing certain system parameters but those changes may then cause another component to function poorly or not at all. Components can become so intertwined, and their deleterious effects can be so subtle, that a user often cannot correct a performance problem simply by uninstalling a component, even if he or she somehow figures out which component is causing the problem. The scope of this problem is magnified by the ubiquity of applications downloadable from the Web.
The user often exacerbates an existing problem with repeated attempts at a fix, each attempt altering the computer in further complicated and often unfortunate ways. By the time the user calls in a technical support specialist, often the only options left open are for the user to accept reduced performance and strange behavior or to accept the drastic solution of having his or her computer""s disk wiped clean and the operating system and applications reinstalled. While this usually works to restore the computer to a working state, the user must then carefully restore all the safe, but only the safe, settings, options, and preferences that tailor the computer to his or her specific needs. Of course, if the user actually knew which of these were safe and which were not, he or she might not be in this predicament in the first place.
Backup and restore systems have been developed to address these problems. In one model of operation, the state of the computer is periodically saved by storing a copy of those files that together define the state of the computer. When the user notices a problem, the computer is restored to the state it was in at the time a backup was taken by overwriting current files with the copies of those files created by the backup system. In another model of operation, full file copies are not created, rather all changes to the files are noted in a log. During restore, the changes are xe2x80x9cundonexe2x80x9d one by one until the state of each file at the desired time is recreated. Using either model of operation, a computer will often contain several backups taken at different times and the user will choose to restore to a backup taken shortly before the current troubles began.
Current backup and restore systems, however, consume enormous amounts of computer resources, both disk and processor. Systems based on file copying store a full copy of each file during each backup and this requires a great deal of disk space. Logging systems try to save disk space but do so at the cost of an often unacceptable demand on processor time. If a file changes too often, the change log may exceed the size of the file which negates the disk savings. Additionally, current systems are very difficult for the user to configure and are often inflexible with regard to the user""s specific circumstances.
The above problems and shortcomings, and others, are addressed by the present invention, which can be understood by referring to the specification, drawings, and claims. The present invention is a backup and restore system that minimizes computer resource use by combining the backup methods of file copying and file logging. During backup, copies are stored of those files that are expected to change frequently. For other files, changes are noted in a change log and backup copies may be made if they would be useful when later restoring the files. Restoration proceeds by overwriting the frequently-changing files with stored copies and by undoing the changes to the logged files. This combined technique applies the most suitable backup method to each file, saving on both disk space and processor time.
The combined technique can be implemented in ways that achieve further resource savings. Processor use may be minimized by an implementation of file change monitoring that intercepts calls to the file system. If the call would affect a monitored file, then the change is logged, and a copy of the file is stored, before the operation is allowed to complete. Restoration time may be shortened by preprocessing the log of file changes to eliminate extraneous operations, such as a paired file creation and subsequent deletion. Other aspects of the current invention may be found in the detailed description below.